Hot answers tagged

24

Yes, bcrypt has a maximum password length. The original article contains this: the key argument is a secret encryption key, which can be a user-chosen password of up to 56 bytes (including a terminating zero byte when the key is an ASCII string). So one could infer a maximum input password length of 55 characters (not counting the terminating zero). ...


20

Any program that, at some point, calls bash is affected. In particular the os.system function is vulnerable if the system has bash as /bin/sh, so any program calling it (or some equivalent) is vulnerable too. The popen functions can be vulnerable, depending on the arguments passed. Quoting from the documentation: Also, for each of these variants, on ...


10

Yes, BCrypt has an upper limit of 72 characters. It's a limitation by the Blowfish cipher itself. One way to work around it is by using SHA-256 first and then BCrypt the result. In your case it would be something like hashpw(sha256('pass'), salt)


9

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do. The distance from the "metal" is a matter of ...


9

Once an attacker already has access to the system it's already way too late. The main concern for not leaking the key is because it is often used as a seed for hashing and signing sessions. The idea is that your production SECRET_KEY needs to be completely different than your development or staging SECRET_KEY. You can actually randomly generate it every ...


8

This is about the easiness of "hiding a backdoor in plain sight", namely in the source code. We are no longer talking about compilers, but about human brains. The whole idea is to make the source code "look legit" for a human code inspector, who do not have time to really delve into details, and who uses his human mind for the task, with all the quirks that ...


7

Yes, popen is affected by ShellShock. However, I do not have a comprehensive list to provide you - anything that is backed by a call to /bin/bash (such as a call to /bin/sh which links to /bin/bash - which is assumed in the below quote) is vulnerable. A range of web apps written in PHP, Python, C++ or Java could be vulnerable if they use calls to ...


7

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular expression will take exponential time rather than linear time when applied to a string. An attacker could construct a regular expression that takes the maximum amount ...


6

The class attribute could be used for redressing the UI to make untrusted elements and text appear to be authoritative text coming from the website itself. See the Google Browser Security Handbook for more information. Instead of writing your own, use an established HTML sanitiser such as Google Caja. These are hard to write because there are so many ways ...


5

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


5

I ran into the same issue when using a Ruby gmail gem. According to this post, "less secure apps" directly handle your credentials, rather than using something like OAuth that verifies your identity without exposing your credentials to the app. Given that your app is running locally on your machine (and you hopefully trust it!) this shouldn't be a problem.


4

Virtual machines work as sand boxes to keep bad things in, not bad things out. If the host is compromised, so are the containers running within it as the virtual machine has to call out to the host for many actions and the host has full awareness and control over the system running within it.


4

Short version: Shell scripts require more caution with untrusted input; there are inherent dangers. Shell scripts are not general purpose languages, and are probably unsuited for "parsing untrusted data over networks" All that said, shell scripts can do amazing amounts of things, and can do it securely with enough care. Should is a different matter, and ...


4

About writing tools like this SYNFlood, python is as good as any other language you feel comfortable with. There is an excellent book called "Violent Python" where you will learn to write security auditing tools and malwares. From network scanners, login bruteforcers, FastFlux behavior to mimicking botnet functionalities, you will learn a lot about them. ...


4

One solution is to forbid access to the folder where the sensitive files are stored, so that it is not possible to access them directly. For example, place these files under http://siteis.com/secured_uploaded_files/ and place a .htaccess file there (for apache) to prevent access. You can also place the files outside the web server's document root. Step two ...


4

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


4

To approach this problem from a different angle, how about creating a domain specific language? Why give the users the ability to do a plethora of things you don't want them to be able to do, and then attempt to sandbox and contain the power you're giving them? Instead, create a simple language that can only be used for plotting, and interpret it with ...


3

I don't think that the code you are marking is the one achieving to exploit the bug: s.send(struct.pack('>I',len(buff) )) What this line is doing is sending the length of the buffer he is going to send right behind in the proper endiannes (Big Endian or network endiannes). I believe that the exploit itself will have to do with the lengths of the ...


3

No, this is impossible. For CalDAV and CardDAV to work the server needs to be able to see the contents of the file in order to respond to the WebDAV/CalDAV/CardDAV methods REPORT and PROPFIND and similar.


3

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell. There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when ...


3

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so ...


3

If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want. Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...


3

BeatifulSoap is not designed as a Sanitizer for HTML but primarily designed for extracting data from the HTML like needed in screen scraping. That is don't expect it to deal correctly with malformed HTML which nevertheless gets executed by the browser. Apart from that a large part of your question is already answered in your previous one. And to cite myself ...


3

This functionality already exists in Nmap, in the pjl-ready-message NSE script. Here's an example usage: nmap -p 9100 --script pjl-ready-message --script-args pjl_ready_message="your message here" 192.0.2.0/24 The script already checks for a real PJL service before sending the command, so you probably don't have to check for OS fingerprint results.


3

Python 2 is by no means "legacy software". Both version of Python are still being continually developed by its community. As you may see, Python 2 and Python 3 have recently been updated, with Python 2 being the latest release (December 2014). By my experience, you should keep at Python 2, as there are LOTS of modules that were developed to Python 2 and ...


3

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, then follows the actual attack while(1); (DOS attack), and then the still standing ' is transformed to valid syntax via var foo='bar. Up to version 2.4 of ...


3

There really is no value in double or triple encrypting data in the manner you describe. First, as a non-cryptographer, you cannot know the level to which you may compromise the crypto process. You absolutely can do that when combining algorithms. A good example of this is 3DES, which is really 3 cipher rounds of DES with the 144 bit key being three 48 bit ...


3

This is a two-part answer: You must overcome any obfuscation or get to some sort of decompiled state. See this question on StackExchangeRE for more details on Python obfuscation. Once you have the code (or if you have the source in the first place), you will want to utilize a mixture of secure code review, runtime analysis, and security-focused static ...


3

Based on information in this question, I was able to successfully reproduce a hash. After setting my password to password, I executed these commands $ sudo grep neil /etc/shadow neil:$6$GpNiWKnm$aToSshPrg45wXFuP/Hmkkpf8/GUYg0d/C4eU/BH7iG2QwM.C59NIVr/izGUGXzf7HjqQNmpFXhxtIxGtXNrmj0:16793:0:99999:7::: $ python -c 'import crypt; print crypt.crypt("password", ...


2

When writing binary output data try instead using open('bomber.out', 'wb').write(data) I can't verify if this will help but it might be worth a try.



Only top voted, non community-wiki answers of a minimum length are eligible